Three firewall migrations later, nobody can say which rules exist, and change control will not approve the next one without evidence. You get an ordinary corporate seat, no console and no exported config. Probe each zone crossing until the rule base identifies itself by number.
Mission brief · N-403
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
EDR console (detections + live response)
Endpoint detection & response
Live-response shell on the affected host
Host shell session
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
You may act alone
Ask a human first
Firewall documentation rots faster than firewall configuration. Analysts who can only describe a rule base from a wiki cannot tell an incident commander whether a path was possible, and change reviewers cannot approve a migration on that basis. Probing from a normal seat produces evidence that stays true regardless of what the documentation claims.
Before any probe means anything you need to know which zone you are speaking from. The connected network and the default gateway define the source of every test, and a report that omits them cannot be reproduced by the person reviewing it.
It is tempting to record only what is blocked, but a migration breaks on the permits nobody wrote down. A verbose probe that succeeds names the rule that carried it, and that number is what survives into the change record.
Where no specific rule exists, the default deny at the bottom of the base is what enforces the boundary. Naming that catch-all is how you distinguish a deliberate boundary from an accidental one, and it tells a reviewer the base terminates safely.
Scanning production from a corporate seat happens under a change record. The habit of tying discovery activity to an authorization is what separates an audit exercise from an incident of its own.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
19 of 19 rubric rules hold.
Gate denied — 93%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
The same enumeration an intruder performs on arrival - what subnet am I in, who routes, what may I reach - run deliberately, so each permit and deny in the perimeter rule base is evidenced by number.
| Technique | Name | Tactic |
|---|---|---|
| T1046 | Network Service Discovery | Discovery |
| T1016 | System Network Configuration Discovery | Discovery |
| T1018 | Remote System Discovery | Discovery |
| T1049 | System Network Connections Discovery | Discovery |
The workflow reached a terminal success state on the graded run.
behavior · weight 20 · T1046 Network Service Discovery (Discovery)
A reversible action passed through a human approval gate.
safety · weight 15 · T1046 Network Service Discovery (Discovery)
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10 · T1046 Network Service Discovery (Discovery)
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10 · T1018 Remote System Discovery (Discovery)
The case carries an analyst closure note explaining the outcome.
explanation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15 · T1046 Network Service Discovery (Discovery)
The playbook survived the integration faults it met and still finished.
configuration · weight 15 · T1018 Remote System Discovery (Discovery)
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10 · T1049 System Network Connections Discovery (Discovery)
The rule base was evidenced from probes rather than transcribed from memory.
investigation · weight 10 · T1018 Remote System Discovery (Discovery)
The connected subnet was read from the routing table.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The default gateway was read from the routing table, which anchors every other hop.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
A permit was evidenced by number, so the AD path is documented rather than presumed.
investigation · weight 10 · T1018 Remote System Discovery (Discovery)
The egress path is documented by the rule that permits it, not by the fact the browser works.
behavior · weight 10 · T1049 System Network Connections Discovery (Discovery)
Endpoint isolation inside the VLAN is proven by a numbered deny.
behavior · weight 15 · T1046 Network Service Discovery (Discovery)
The absence of a user-to-DMZ permit was proven, and the catch-all that enforces it named.
behavior · weight 15 · T1046 Network Service Discovery (Discovery)
A rule-base map was filed, which is the deliverable change control actually asked for.
explanation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
investigation · weight 3
Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
investigation · weight 3
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
| case | Incident | Container | Case |
| note | War Room entry | Note | Case note |
| approval | Manual task | Prompt | Page |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
Security groups, network policies and NACLs all answer the same interrogation: from this source, to that destination, on this port, which statement decided the outcome? The tool changes; the evidence standard does not.
CYBRARY